Marcos Jr. approves SIM Registration Act amid privacy and rights concerns

The first legislation that Ferdinand Marcos Jr. signed into law as president is the Subscriber Identity Module or SIM Registration Act or Republic Act (RA) 11934. He signed the law on October 10, 2022 after both houses of Congress transmitted the bill to Malacañang on October 4.

Former president Rodrigo Duterte vetoed the SIM Registration Law earlier this year, due to the belatedly inserted provision on social media registration. Many groups, local and international, panned the requirement for users to use their real names and contact numbers when creating social media accounts.

After the large-scale text phishing scams and spams happening while the law was being revived under the new administration and the removal of the assailed provisions on social media registration and centralized database or SIM register, the legislation seemed to have gotten lesser flak from the public and moved quicker to being passed into law.

However, many of the risks and criticisms raised by various groups on mandatory SIM registration remain:

• Eradicating the potential for anonymity of communications, as prohibitions of anonymity interfere with the right to privacy and freedom of expression. In repressive environments, anonymity is the only protection enjoyed by whistleblowers, human rights defenders, journalists, political opposition and government critics.
• Posing risks to the rights to privacy, free expression and information, and association by facilitating targeting, profiling and surveillance
  • Enables location-tracking
  • Enables tracking of device within a mobile network through the collection and identification of the SIM serial number (IMEI) and also tracking of user activities on the device
  • Simplifies communications surveillance and interception
  • Individual’s mobile number could potentially be matched with their political activity or voting preferences (allowing government to identify and target political opponents) or confidential health data, such as people living with AIDS/HIV
  • SIM users’ information can be shared and matched with other private and public databases, enabling the government to create comprehensive profiles of citizens
  • While the law may improve crime investigations and national security, it is equally likely to enable the surveillance of human rights defenders, activists, and other groups whose work deals with anonymity and confidentiality such as doctors, lawyers and journalists
  • May discourage victims of crime or human rights violations or the marginalized by allowing them to speak out against oppression and abuse without fear of retaliation
  • May discourage anonymous tips from whistleblowers
• Discriminating against marginalized groups or vulnerable sectors
  • Poorest individuals may not have valid identification documents and may be excluded from services requiring such
  • Remote areas have limited telecommunication or internet access
  • Lived names of transgender and gender diverse individuals may be deemed as “fictitious identities” or false information under the law and in the absence of legal gender recognition in the country, and they will be forced to use dead names to register
• Law grants sweeping powers to the Philippine authorities (unless any of these could be fleshed out or made clearer in the implementing guidelines of the law):
  • Authorities can demand and receive disclosure of information obtained in SIM registration by court order or subpoena, but without adequate independent oversight to monitor government demands for private information disclosure
  • No provisions on secure holding or furnishing of such information
  • No stipulated penalties for private information misuse or resulting dangers or violations to rights of end users (while also removing accountability of telcos for disclosure by request of authorities).
  • SIM spoofing is illegal and punishable with hefty fines and imprisonment under the law except in “authorized activities of law enforcement” and a “court order specifically authorizing the use of caller ID manipulation.”

“We will soon be able to provide law enforcement agencies the tools needed to resolve crimes perpetrated with the use of these SIM cards as well as providing a strong deterrence against the commission of wrongdoing,” Marcos Jr. said in the ceremonial signing of the law.

However, the law only provides penalties for failure to register SIM, penalization for the breach of confidentiality and negligence of telcos; and the spoofing of SIM and use of stolen or previously registered SIM by end users. It does not provide ways to curb SIM-related crimes save for registration and does not provide penalties for those using SIM cards for crime or malicious or unlawful acts against unsuspecting victims except for spoofing.  

Questions on the effectiveness of the crime-curbing powers of mandatory SIM Registration over security risks, state surveillance and social exclusion that became collateral issues in many other countries implementing a similar law have yet to yield satisfying answers.

The Philippines is now one of over 150 countries in the world to have mandatory SIM registration, held in the world over to be for combatting crimes and scams using SIMs. But a2016 GSMA report states there is no empirical evidence that mandatory SIM registration directly leads to a reduction in crime.

Anonymous calls or messages are not only possible through the use of SIM cards and SIM registration eliminates only one of many possible ways to deliver scams (others may go back to email spam or use mobile apps). Criminal elements may find a way to undermine the law and use those who abide by it to bypass the law. Hackers could hack into unregistered SIMs. A single or a handful of unregistered, smuggled or stolen SIM cards could render the law ineffective. When these things happen, all that will be left is a database of personal and other SIM card information controlled by private telcos and the government, for administration, governance, profit or whatever use they see fit or can pass within the legal processes to obtain a citizen’s private information.

Read on to know more about the SIM Registration Act. 

Effectivity:

• RA 11934 shall take effect 15 days after publication.
• The Implementing Rules and Regulations of the law is expected within 60 days after the effectivity of the law. The National Telecommunications Commission, in coordination with the Department of Information and Communications Technology (DICT), National Privacy Commission, and Department of Trade and Industry among other government agencies, as well as public telecommunication entities (PTEs) and major consumer groups, shall set the guidelines for the monitoring and proper implementation of the law.

SIM registration is required for all end-users:

• All new SIMs that will be sold will be in a deactivated state. Registration is required for activation of the SIM.
• Current SIMs in use are given 180 days from the law’s effectivity to be registered. The DICT may extend this up to 120 days.
• Failure to register within the periods prescribed will lead to deactivation of the SIM.
• Registration is free or at no cost to end-users.

SIM register:

• PTEs (or any person, public or private, engaged in the provision of telecommunication services to the public for compensation) and shall be responsible for maintaining and securing their own database of information on SIM registration. There is no feature in the law for a central database which was one of the provisions in the SIM Registration Law that Duterte vetoed.
• PTEs shall include data of existing postpaid subscribers in their SIM register. 
• The database shall strictly serve as a SIM Register to be used to process, activate and deactivate a SIM.
• PTEs shall report any incident of cyber-attack on their SIM register to the DICT within 24 hours of detection.

Process of registration:

• Submission of duly-accomplished control-numbered owner’s registration form electronically through a platform or website to be provided by the PTEs. The form shall include a declaration that the information and identification documents provided are true and correct and that the end-user of the SIM accomplished the form.
• End-users will provide their full name, date of birth, sex and address.
• Assigned mobile number of SIM and serial number will also be registered
• Presentation of valid government ID with photo, such as but not limited to:
  • Passport
  • Philippine ID
  • Social Security System ID
  • Government Service Insurance System E-Card
  • Driver’s license
  • National Bureau of Investigation clearance
  • Police clearance
  • Firearms’ license to own and possess ID
  • Professional Regulation Commission ID
  • Integrated Bar of the Philippines ID
  • Overseas Workers Welfare Administration ID
  • Bureau of Internal Revenue ID
  • Voter’s ID
  • Senior Citizen’s Card
  • Unified Multipurpose ID
  • Person with disability card, or
  • Other valid government ID with photo
• PTEs and relevant government agencies shall facilitate registration in remote areas with limited telecommunication or internet access.
• Changes in end-user information need to be updated in the SIM registration. PTEs shall update the changes in their database.

For minors and foreigners:

• Registration of SIM of minors shall be under the name of parent or guardian.
• Foreign nationals also need to register their SIM by providing their full name, nationality, passport and passport number, address in the Philippines, Alien Employment Permit from the Department of Labor and Employment or Alien Certificate of Registration ID from the Bureau of Immigration or School Registration and ID for students, or other pertinent documents.
• Foreign tourists shall also register their SIM and provide their name, address in the Philippines and return ticket to their country. The SIMs of foreign tourists shall be valid only for 30 days.

In case of end-user death, SIM got lost or stolen or request for SIM deactivation:

• The above incidents or request shall be reported to the PTE. The concerned SIM will then be deactivated within 24 hours after the incident is reported or request is made.
• The PTEs will keep the data on the SIM for 10 years after deactivation.

Confidentiality and disclosure of information:

• Any data obtained in SIM registration process shall be treated as absolutely confidential from the point of registration and shall not be disclosed to any person.
• However, PTEs may disclose full name and address:
  • In compliance with the Data Privacy Act of 2012
  • In compliance with a court order or legal process
  • Upon issuance of subpoena by competent authority pursuant to an investigation based on a sworn complaint that a specific mobile number was used in the commission of a crime or malicious or unlawful act
  • With written consent or waiver of the subscriber
• No PTE shall be held administratively, civilly or criminally liable on account of disclosure in compliance with the SIM Registration Law

Penalties:

• P100,000 to P1 million fine for the first to succeeding offenses for failure or refusal of PTE o telco to register a SIM
• P500,000 to P4 million fine for the telco or its employees or agents’ breach or negligence of information confidentiality
• P100,000 to P300,000 or 6 months to 2 years imprisonment or both for providing false information, using a fictitious identity or fraudulent identification documents to register a SIM
• P200,000 or imprisonment of not less than 6 years or both for spoofing a registered SIM

House Speaker Martin Romualdez is the main author of the SIM Registration Act approved by the House (House Bill No. 14), with Reps. Ferdinand Alexander “Sandro” A. Marcos and Tingog party-list Reps. Yedda Marie K. Romualdez and Jude Acidre as co-authors.

Senator Grace Poe, chairperson of the Senate Committee on Public Services, sponsored the SIM Registration Act in the Senate (Senate Bill 1310) and was also the sponsor and main proponent of the vetoed SIM Registration Law under Duterte.